Analysis
- user interaction
yes - max time kernel
128s - max time network
131s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/07/2026, 14:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
KayzeLauncher.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
KayzeLauncher.exe
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
General
- Target KayzeLauncher.exe
- Size 1.7MB
- Sample260723-r4alks1dmc
- SHA256 d04750b5b40f0989ca0a9497a49c442d7a0103d568627a40cb9cfd3bd4a62c06
- MD5 92bfa259b3f9288475da7efb548db756
- SHA1 f3ef49b9778738a21e6bda756d8e9aabf3b76163
- SHA512 4c6b4f10492ca5c2fc4abe49afb347bb8cb91a91eeeea867ddb05094e03eff7b670a082c0685dbfc983a1ef6e42d27974e41322d8a0eee488b1cc3ac0ff815b1
- SSDEEP 24576:iA4sAxuIiKem8bqaitOZLiSZnnjS3GoRGXyei:rBAxuIEm0qaGy2knjSWoRGX
- TLSH T15E859D0CF6B5CAA9CDD6417948418963A2B37D3923D277CB4B606AE7BA53FC20173271
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3324 cod.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2100 KayzeLauncher.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2100 KayzeLauncher.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2100 wrote to memory of 3324 2100 KayzeLauncher.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\KayzeLauncher.exe"C:\Users\Admin\AppData\Local\Temp\KayzeLauncher.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\fake_games\Call of Duty_ Black Ops 7\cod.exe"C:\Users\Admin\AppData\Local\Temp\fake_games\Call of Duty_ Black Ops 7\cod.exe"2⤵
- Executes dropped EXE
PID:3324
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\09EC553619BC82A45E441B5D9BEB4136
- Size 281B
- SHA256 08af1e2a0e48fecea8f38ddb1ff94dfa273b023f0c601a072900c9710372a75d
- MD5 acb9062dadaebc65bb03b8a9ee75215a
- SHA1 d50b20f463825dd2f2a89a35ac516e51730b3dc6
- SHA512 0489553e2e7b568eb5df7e74b690519c9d4acf54b1acf3bf8de131d78613e4cd95f5f565572f774aea23c846346f66e18b4a67a7c1fd99b6add3dc18873d705d
- TLSH T18BD0C29112BDBCD76EA39B9542E28428340267B113D63A659C29991A982097B1B02210
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
- Size 314B
- SHA256 438cde784fda454be529856cb81b400531e2b737c994e280ec332ed0df73e90d
- MD5 26a56fe8e6dc0be55c651e3b1aa85721
- SHA1 4a23c72a4a83a29b56e7c99f2531555d4853784f
- SHA512 75c8ba218df1f79a60bfa1cfba6da098d0f9553b6512e5bd253b6c802e8bf5897fc2516f8ede1a9bc3fb6f44259763aff8d04e7dfd493661ce7fff974d86417e
- TLSH T1CBE07D13BB68899BBD33442406E304BEB8B1548A44C54715382A02CE4C9223F8603115
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
- Size 978B
- SHA256 eeea6259e9e6054739a1e86b0d324ddd03b29b8e10c3d30b52a4862640f23052
- MD5 641b9441346ec976d2caac5d61bb6310
- SHA1 99b0d41d7b66594404f2c469614d1ea1323a54a5
- SHA512 6e9427858722e09605e1bac18d386c02551994baa09d06997ea5f70f79ba009546624d5a05cef95cd1814a8510b6bcc9ce8a3d7d3e1455f38c5f4389a35ca7a4
- TLSH T1051121C65FF5A09095F347A0CAF4D5367C7970C62CEA74C01C82889224AAB2E7B5943F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\09EC553619BC82A45E441B5D9BEB4136
- Size 488B
- SHA256 3690927694e83fdf9f47979776054633199ea41955f4e54f3464ec2829efa713
- MD5 93fa9dd980cc18dffcc280e54c4962cf
- SHA1 aa03baba7432d67843c7c57d24d9afedd8d85ac5
- SHA512 0e03f70ffe6500acd4d054ab7aca4f4cdd7d375ea4d169809361c7cdb175751c1ed340881323c919ac0b9b89a166cd1c033a508148a1f08a05ccae4779f1c7cc
- TLSH T134F05C1834BC4118E572D87DC7E5716AEC29F0266C046B733B9756065A05F001C6743E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\18159EBD3277736D0444419407768451_2FD781D15115165DD3192E4E42E088C7
- Size 488B
- SHA256 4c8e5eb6bef0d35b24f164c856ba2fc90fa1b6d83aaf1845dfefaa241963f7ef
- MD5 4ee1d9bf7190a9d403f2b5702d9aa7a7
- SHA1 94f428f556366c93f09f2b223453dec2bf6f9b39
- SHA512 5133f1ec3ca3f46be62037fc100fc28af6400d0434545a0a2879a21faf3f171e568a761fcd3ca1c92568e353d3bcf51be14b5604cf0ed6a9a6b9d1ffdf6d573c
- TLSH T1D1F05C2C26BC803DE176DB7596C4B3D1DD16E123280885D91BE30A4CA602E012CA157D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_A16793B4EA930C0E219244CEE32C9A44
- Size 488B
- SHA256 0832662deb30941479413a0854e8e9840854f34af3d70ba6107b65d72439c6ba
- MD5 6d17f0f66ce4ddeafeb2ed1c29fb6033
- SHA1 0a9e256d2f1b7d60796044a00fa48d0f5741ed06
- SHA512 850dc33e3b4ec0600f90f76c76af60e919976a78d322b07fee047e5a3930cab9e419a22973fb385d0e74412999a47d8412e3bc8aad37ebd347a1cbe2febe4909
- TLSH T1ACF0A3241AF6442FF771277806F4A39ABD14B2173401C96E3AB61309EE17F405D1153C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\fake_games\Call of Duty_ Black Ops 7\cod.exe
- Size 1.7MB
- SHA256 d04750b5b40f0989ca0a9497a49c442d7a0103d568627a40cb9cfd3bd4a62c06
- MD5 92bfa259b3f9288475da7efb548db756
- SHA1 f3ef49b9778738a21e6bda756d8e9aabf3b76163
- SHA512 4c6b4f10492ca5c2fc4abe49afb347bb8cb91a91eeeea867ddb05094e03eff7b670a082c0685dbfc983a1ef6e42d27974e41322d8a0eee488b1cc3ac0ff815b1
- SSDEEP 24576:iA4sAxuIiKem8bqaitOZLiSZnnjS3GoRGXyei:rBAxuIEm0qaGy2knjSWoRGX
- TLSH T15E859D0CF6B5CAA9CDD6417948418963A2B37D3923D277CB4B606AE7BA53FC20173271
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\fake_games\Call of Duty_ Black Ops 7\kayze.config
- Size 25B
- SHA256 46644ac288ebd3f3998af055d532e0372479730cc3a838addf4fad8e424bf803
- MD5 c79813b3ee711f35578a7a488b562c46
- SHA1 63457b3acf63f94575260ed9893b37f27e593c11
- SHA512 a65655c803b1397a37abc0ca8d93fd1f894b71962e15323a4014f432405e3765547f8c4318b2119779c0d04c6413455fb42b4b9e051ce061064d14e40a91b31a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\games_cache.temp
- Size 11.7MB
- SHA256 95587f9c21cbf50d2b92f9865ebf0c43dd427179268582db0947aed120d2f816
- MD5 bec188fe4e5154cf8ba7ec33df2aad15
- SHA1 ed326e4ae8300220c10fa9c07187db0b5773870a
- SHA512 7ad004d077f8802fa87bc9d04f05a76498c782d43dd0af020c1bd2c0fb7f226866199cd57f3c857b8169d1ffd2c4fb24950f462b1dcb57cf5807a5e6a522725a
- SSDEEP 24576:Umw8sS6Vid6V9h5MbPTZqbxneeEnVZQgy4RVhZw7E4Jkl5WVGcMmUad1VKh/uNiH:8uZpsu7r
- TLSH T1BAC6AE34A83B567F87C1F79EA4A75A83130D719AD5441D29A89C0E2F338DF3A5722BC4
- MD5 SHA1 SHA512 SSDEEP TLSH